As most SharePoint/OneDrive Users know, on Office 365 there are ways of migrating files and folders from one location to another so that all the native metadata (Modified, Modified By, Created, Created By) is maintained and not altered. There is now a way to detect when files have been touched with (moved, restored, or even tampered)
As an example, if you have a file that resides in a modern library, you can move that file to another folder in the same library or to a distinct library and the metadata values for Modified, Created, Modified By, and Created By will remain unchanged. The picture below shows how one can initiate a file move without having these values changed.
I have discovered, thanks to one of my very sharp clients, that this works fairly well, but not perfectly.
In the figure below you can see that I have now opened the Information Panel that was not showing in the image above. This picture reveals that the file was "created" 36 minutes ago, and not on or before November 20th.
For those of you who need to do careful forensic work on files and folders, this may be helpful to you. The same behavior happens when you use tools like Sharegate or Metalogix for migrations or bulk meta data editing. Furthermore AvePoint for Content restoration also leaves behind this-tell tail sign.